CVE-2026-27222

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27222", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "state": "PUBLISHED", "assignerShortName": "adobe", "dateReserved": "2026-02-18T22:02:41.380Z", "datePublished": "2026-04-14T19:44:58.971Z", "dateUpdated": "2026-09-08T19:55:38.925Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Adobe Experience Manager as a Cloud Service", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "2026.7.0", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "2026.8.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Adobe Experience Manager 6.5 LTS", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "SP2", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "SP3", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Adobe Experience Manager 6.5", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "6.5.24", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "6.5.25", "versionType": "custom"}]}], "datePublic": "2026-09-08T17:00:00.000Z", "descriptions": [{"lang": "en", "value": "Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "environmentalScore": 5.4, "environmentalSeverity": "MEDIUM", "exploitCodeMaturity": "NOT_DEFINED", "integrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "LOW", "modifiedAttackVector": "NETWORK", "modifiedAvailabilityImpact": "NONE", "modifiedConfidentialityImpact": "LOW", "modifiedIntegrityImpact": "LOW", "modifiedPrivilegesRequired": "LOW", "modifiedScope": "CHANGED", "modifiedUserInteraction": "REQUIRED", "privilegesRequired": "LOW", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "scope": "CHANGED", "temporalScore": 5.4, "temporalSeverity": "MEDIUM", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "Cross-site Scripting (Stored XSS) (CWE-79)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-09-08T19:55:38.925Z"}, "references": [{"tags": ["vendor-advisory"], "url": "https://helpx.adobe.com/security/products/experience-manager/apsb26-98.html"}], "source": {"discovery": "EXTERNAL"}, "title": "Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)", "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-15T17:38:19.845585Z", "id": "CVE-2026-27222", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T17:39:30.343Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27222", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-15T17:38:19.845585Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T17:38:26.722Z"}}], "cna": {"title": "Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)", "source": {"discovery": "EXTERNAL"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "modifiedScope": "CHANGED", "temporalScore": 5.4, "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalSeverity": "MEDIUM", "availabilityImpact": "NONE", "environmentalScore": 5.4, "privilegesRequired": "LOW", "exploitCodeMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NETWORK", "confidentialityImpact": "LOW", "environmentalSeverity": "MEDIUM", "availabilityRequirement": "NOT_DEFINED", "modifiedIntegrityImpact": "LOW", "modifiedUserInteraction": "REQUIRED", "modifiedAttackComplexity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAvailabilityImpact": "NONE", "modifiedPrivilegesRequired": "LOW", "modifiedConfidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Adobe", "product": "Adobe Experience Manager as a Cloud Service", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "2026.7.0"}, {"status": "unaffected", "version": "2026.8.0", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Adobe", "product": "Adobe Experience Manager 6.5 LTS", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "SP2"}, {"status": "unaffected", "version": "SP3", "versionType": "custom"}], "defaultStatus": "unaffected"}, {"vendor": "Adobe", "product": "Adobe Experience Manager 6.5", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "6.5.24"}, {"status": "unaffected", "version": "6.5.25", "versionType": "custom"}], "defaultStatus": "unaffected"}], "datePublic": "2026-09-08T17:00:00.000Z", "references": [{"url": "https://helpx.adobe.com/security/products/experience-manager/apsb26-98.html", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Cross-site Scripting (Stored XSS) (CWE-79)"}]}], "providerMetadata": {"orgId": "078d4453-3bcd-4900-85e6-15281da43538", "shortName": "adobe", "dateUpdated": "2026-09-08T19:55:38.925Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27222", "state": "PUBLISHED", "dateUpdated": "2026-09-08T19:55:38.925Z", "dateReserved": "2026-02-18T22:02:41.380Z", "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538", "datePublished": "2026-04-14T19:44:58.971Z", "assignerShortName": "adobe"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Adobe Experience Manager as a Cloud Service", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "2026.7.0", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "2026.8.0", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Adobe Experience Manager 6.5 LTS", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "SP2", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "SP3", "versionType": "custom"}]}, {"defaultStatus": "unaffected", "product": "Adobe Experience Manager 6.5", "vendor": "Adobe", "versions": [{"lessThanOrEqual": "6.5.24", "status": "affected", "version": "0", "versionType": "custom"}, {"status": "unaffected", "version": "6.5.25", "versionType": "custom"}]}], "source": "psirt@adobe.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:adobe:bridge:*:*:*:*:*:*:*:*", "matchCriteriaId": "8B4FBE0D-49AE-47B0-9A02-CF772B606C89", "versionEndExcluding": "15.1.5", "vulnerable": true}, {"criteria": "cpe:2.3:a:adobe:bridge:*:*:*:*:*:*:*:*", "matchCriteriaId": "AA94FD4C-CD52-43BC-9DD6-C688A783A5F9", "versionEndExcluding": "16.0.3", "versionStartIncluding": "16.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E", "vulnerable": false}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field. Scope is changed."}, {"lang": "es", "value": "Las versiones 16.0.2, 15.1.4 y anteriores de Bridge se ven afectadas por una vulnerabilidad de divisi\u00f3n por cero que podr\u00eda provocar una denegaci\u00f3n de servicio de la aplicaci\u00f3n. Un atacante podr\u00eda explotar esta vulnerabilidad para bloquear la aplicaci\u00f3n o dejarla sin respuesta. La explotaci\u00f3n de este problema requiere interacci\u00f3n del usuario, en el sentido de que la v\u00edctima debe abrir un archivo malicioso."}], "id": "CVE-2026-27222", "lastModified": "2026-09-08T20:17:31.397", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "psirt@adobe.com", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27222", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-15T17:38:19.845585Z", "version": "2.0.3"}}]}, "published": "2026-04-14T20:16:32.927", "references": [{"source": "psirt@adobe.com", "url": "https://helpx.adobe.com/security/products/experience-manager/apsb26-98.html"}], "sourceIdentifier": "psirt@adobe.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "psirt@adobe.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,15.1.4]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Bridge", "source": "cna", "vendor": "Adobe"}, "product": "bridge", "vendor": "adobe"}], "created": "2026-04-15T14:28:41.002496+00:00", "updated": "2026-09-10T06:00:08.215399+00:00", "vendors": ["adobe", "adobe$PRODUCT$bridge"]}